GRSecurity Linux Kernel Memory Protection Weakness

Bugtraq ID:	4762
Class:	Design Error
CVE:
Remote:	No
Local:	Yes
Published:	May 17 2002 12:00AM
Updated:	May 17 2002 12:00AM
Credit:	Vulnerability discovery credited to Guillaume PELAT <[email protected]>.
Vulnerable:	grsecurity grsecurity Kernel Patch 1.9.4 - Linux kernel 2.4.18
Not Vulnerable:

GRSecurity Linux Kernel Memory Protection Weakness

An attacker with root access may be able to write to kernel memory in spite of the security patch provided by grsecurity. The patch operates by redirecting the write() system call, when it is being used to write to a memory device. Unfortunately, there are other methods that can be used to write to kernel memory (such as mapping the device to memory using mmap()).

GRSecurity Linux Kernel Memory Protection Weakness

Exploit contributed by Guillaume PELAT <[email protected]>:

• /data/vulnerabilities/exploits/kmem_mmap.tgz

GRSecurity Linux Kernel Memory Protection Weakness

Solution:
Currently the SecurityFocus staff are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

GRSecurity Linux Kernel Memory Protection Weakness

References:

• Homepage (grsecurity)
  
• Using mmap on /dev/mem or /dev/kmem to modify the kernel (Guillaume PELAT )